Vendored SigV4 known-answer drift guard (#11) #14

Merged

stephen merged 1 commit from feat/11-sigv4-drift-guard into main

2026-07-02 04:24:40 +00:00

stephen commented

2026-07-02 04:05:49 +00:00

Owner

Why

sigv4/S3 signed-HTTP client is copy-pasted across the artifact + cache actions and has drifted (download-artifact-action#11). This adds a vendored known-answer SigV4 test so any future drift in the signer fails CI.

What

tests/sigv4.test.js: pins canonical request, string-to-sign hash, signed headers, signature hex, and Authorization header for a fixed key/region/timestamp/payload.
Same vector vendored into all three action repos (download/upload/cache) so drift is caught everywhere.

Testing

npm test + npm run check pass locally.
Remote test.yml dispatched on the branch: green.

## Why sigv4/S3 signed-HTTP client is copy-pasted across the artifact + cache actions and has drifted (download-artifact-action#11). This adds a vendored known-answer SigV4 test so any future drift in the signer fails CI. ## What - tests/sigv4.test.js: pins canonical request, string-to-sign hash, signed headers, signature hex, and Authorization header for a fixed key/region/timestamp/payload. - Same vector vendored into all three action repos (download/upload/cache) so drift is caught everywhere. ## Testing - npm test + npm run check pass locally. - Remote test.yml dispatched on the branch: green.

stephen added 1 commit

2026-07-02 04:05:49 +00:00

Add SigV4 drift guard test

ci / test (pull_request) Successful in 7s

Details

test / unit (pull_request) Successful in 6s

Details

test / e2e-post-save (pull_request) Successful in 5s

Details

test / e2e (pull_request) Successful in 6s

Details

bb084ba83a